Communication monitoring method and communication monitoring system

Abstract

This method includes: extracting, from communication in a network, a first communication triplet that is a 3-tuple including information indicating a source device, information indicating a destination device, and information indicating the type of communication performed between devices; determining whether the first communication triplet extracted corresponds to any of a plurality of second communication triplets stored in storage in advance as a whitelist and each being a 3-tuple including information indicating a source device, information indicating a destination device, and information indicating the type of communication; and estimating, as a score, a possibility that the first communication triplet emerges as the communication, by using a model that has been trained, when the first communication triplet does not correspond to any of the plurality of second communication triplets.

The invention claimed is: 
     
         1 . A communication monitoring method for monitoring communication in a network, the communication monitoring method comprising:
 extracting, from the communication, a first communication triplet that is a 3-tuple including information indicating a source device, information indicating a destination device, and information indicating a type of communication performed between devices;   determining whether the first communication triplet extracted corresponds to any of a plurality of second communication triplets stored in storage in advance as a whitelist and each being a 3-tuple including information indicating a source device, information indicating a destination device, and information indicating a type of communication; and   estimating, as a score, a possibility that the first communication triplet is suspicious, by using a model that has been trained, and outputting the score when the first communication triplet does not correspond to any of the plurality of second communication triplets, wherein   the estimating of the score includes,   by the model that has been trained, the following:   converting a set of 3-tuples of the first communication triplet into a multigraph in which the information indicating the source device and the information indicating the destination device are nodes and the information indicating the type of communication is a type of an edge, and obtaining vector representation of the first communication triplet from the multigraph; and   estimating the score from the vector representation of the first communication triplet obtained.   
     
     
         2 . The communication monitoring method according to  claim 1 , wherein
 in the outputting,   when the score is less than or equal to a threshold value, a monitoring result indicating that the communication is suspicious is output.   
     
     
         3 . The communication monitoring method according to  claim 1 , wherein the model includes a relational graph convolutional network (R-GCN). 
     
     
         4 . The communication monitoring method according to  claim 1 , wherein
 the estimating of the score further includes,   by the model that has been trained, the following:   estimating the score using a link prediction algorithm from the vector representation of the first communication triplet obtained.   
     
     
         5 . The communication monitoring method according to  claim 4 , wherein
 the model includes a composition-based multi-relational graph convolutional network (COMPGCN).   
     
     
         6 . The communication monitoring method according to  claim 4 , wherein the model includes any of DistMult, convolutional 2D knowledge graph embeddings (convE), translating embeddings for modeling multi-relational data (TransE), holographic embeddings of knowledge graphs (HolE), and complex embeddings for simple link prediction (ComplEx). 
     
     
         7 . The communication monitoring method according to  claim 1 , wherein
 the information indicating the source device is an IP address of a server that is the source device,   the information indicating the destination device is an IP address of a client that is the destination device, and   the information indicating the type of communication includes a TCP/UDP port number or a type of an alert.   
     
     
         8 . The communication monitoring method according to  claim 1 , wherein
 the information indicating the source device is a MAC address or a serial number of the source device,   the information indicating the destination device is a MAC address or a serial number of the destination device, and   the information indicating the type of communication includes a type of an alert or a type of a communication command that is exchanged between the source device and the destination device.   
     
     
         9 . The communication monitoring method according to  claim 1 , further comprising:
 before the extracting,   obtaining the plurality of second communication triplets from network communication performed in a predetermined period; and   performing a learning process using, as data for learning, the plurality of second communication triplets obtained, the learning process including, by the model, obtaining vector representation of the plurality of second communication triplets and estimating, as a score, a possibility that the network communication performed in the predetermined period emerges as normal communication.   
     
     
         10 . The communication monitoring method according to  claim 9 , wherein
 in the learning process of obtaining the vector representation of the plurality of second communication triplets by the model,   a set of 3-tuples of the plurality of second communication triplets is input to the model, and training is conducted, the training including, by the model, mapping the information indicating the source device and the information indicating the destination device to vector representation of a fixed dimension and obtaining the vector representation of the plurality of second communication triplets.   
     
     
         11 . The communication monitoring method according to  claim 9 , wherein
 in the plurality of second communication triplets that are used as the data for learning,   in addition to the type of communication, a feature amount regarding the network communication performed in the predetermined period is included as the type of communication.   
     
     
         12 . The communication monitoring method according to  claim 11 , wherein
 the feature amount includes at least one of an amount of communication per unit time or a median communication time interval in the network communication performed in the predetermined period.   
     
     
         13 . The communication monitoring method according to  claim 1 , further comprising:
 before the extracting,   obtaining the plurality of second communication triplets from network communication performed in a predetermined period;   performing a learning process using, as data for learning, the plurality of second communication triplets obtained, the learning process including, by the model, obtaining vector representation of the plurality of second communication triplets and estimating, as a score, a possibility that the network communication performed in the predetermined period emerges as normal communication; and   estimating, as a score indicating an anomaly level, a possibility that each of the plurality of second communication triplets obtained emerges as a normal communication triplet in the communication, by using the model that has been trained, and outputting the score.   
     
     
         14 . The communication monitoring method according to  claim 1 , further comprising:
 before the extracting,   obtaining, from network communication performed in a predetermined period, a plurality of third communication triplets each being a 3-tuple including information indicating a source device, information indicating a destination device, and information indicating a type of communication;   performing a learning process using, as data for learning, the plurality of third communication triplets obtained, the learning process including, by the model, obtaining vector representation of the plurality of third communication triplets and estimating, as a score, a possibility that the network communication performed in the predetermined period emerges as normal communication;   estimating, as a score indicating an anomaly level, a possibility that each of the plurality of third communication triplets emerges as a normal communication triplet in the communication, by using the model that has been trained, and outputting the score; and   storing communication triplets obtained by excluding one or more third communication triplets from the plurality of third communication triplets based on the score indicating the anomaly level into the storage as the plurality of second communication triplets.   
     
     
         15 . The communication monitoring method according to  claim 14 , wherein
 in the learning process or the re-learning process,   a set of 3-tuples of the plurality of third communication triplets is input to the model, and training is conducted, the training including, by the model, mapping the information indicating the source device and the information indicating the destination device to vector representation of a fixed dimension and obtaining vector representation of the plurality of third communication triplets.   
     
     
         16 . The communication monitoring method according to  claim 1 , further comprising:
 before the extracting,   obtaining, from network communication performed in a predetermined period, a plurality of third communication triplets each being a 3-tuple including information indicating a source device, information indicating a destination device, and information indicating a type of communication;   performing a learning process using, as data for learning, the plurality of third communication triplets obtained, the learning process including, by the model, obtaining vector representation of the plurality of third communication triplets and estimating, as a score, a possibility that the network communication performed in the predetermined period emerges as normal communication;   estimating, as a score indicating an anomaly level, a possibility that each of the plurality of third communication triplets emerges as a normal communication triplet in the communication, by using the model that has been trained, and outputting the score;   performing a re-learning process using, as data for re-learning, communication triplets obtained by excluding one or more third communication triplets from the plurality of third communication triplets based on the score, the re-learning process including by the model obtaining vector representation of the plurality of third communication triplets and estimating, as a score, a possibility that the network communication performed in the predetermined period emerges as normal communication; and   storing communication triplets obtained by excluding one or more third communication triplets from the plurality of third communication triplets based on the score indicating the anomaly level into the storage as the plurality of second communication triplets.   
     
     
         17 . The communication monitoring method according to  claim 1 , wherein
 the estimating of the score includes,   by the model that has been trained, the following:   obtaining vector representation of each element of the first communication triplet by mapping the information indicating the source device and the information indicating the destination device among the set of 3-tuples of the first communication triplet to vector representation of a fixed dimension; and   estimating the score from the vector representation of the first communication triplet obtained.   
     
     
         18 . A communication monitoring system for monitoring communication in a network, the communication monitoring system comprising:
 a memory that stores a program; and   a processor that executes the program, wherein   by executing the program, the processor is configured to:   extract, from the communication, a first communication triplet that is a 3-tuple including information indicating a source device, information indicating a destination device, and information indicating a type of communication performed between devices;   determine whether the first communication triplet extracted corresponds to any of a plurality of second communication triplets stored in storage in advance as a whitelist and each being a 3-tuple including information indicating a source device, information indicating a destination device, and information indicating a type of communication; and   when the first communication triplet does not correspond to any of the plurality of second communication triplets, estimate, as a score, a possibility that the first communication triplet is suspicious, by using a model that has been trained, and output the score, wherein   the estimating of the score includes,   by the model that has been trained, the following:   converting a set of 3-tuples of the first communication triplet into a multigraph in which the information indicating the source device and the information indicating the destination device are nodes and the information indicating the type of communication is a type of an edge, and obtaining vector representation of the first communication triplet from the multigraph; and   estimating the score from the vector representation of the first communication triplet obtained.